Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Nodemailer may let attackers send forged emails
published 1 month ago
Summary
The Nodemailer library used in GitHub Actions had a weakness that could allow a malicious user to create fake or altered email messages. This could be abused to mislead recipients or hide the true source of the email. Updating to the latest TuxCare‑provided version resolves the issue, so apply the new release as soon as possible.
What to do
- Update GitHub Actions nodemailer to version 6.10.1-tuxcare.13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | nodemailer |
< 6.10.1-tuxcare.13 Fix: upgrade to 6.10.1-tuxcare.13
|
Original advisory text
TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 6.10.1-tuxcare.13.
Timeline
Published2 Oct 2026
Updated2 Oct 2026
First seen2 Oct 2026
Sources
CLSA-2026-1790937712 · OSV
Track software like this
Free during beta